davidraviv
2/17/2016 - 2:02 PM

Logstash configuration that accepts json file from filebeat. It overrides filebeat's additional fields and takes the type from the json rath

Logstash configuration that accepts json file from filebeat. It overrides filebeat's additional fields and takes the type from the json rather than filebeat.

logstash.conf
content_copyfile_download
input {
  beats {
    port => 5044
  }
}

filter {
  if [type] == "beat" {
    mutate {
      remove_field => ["type", "beat", "input_type", "offset", "source", "fields"]
    }

    json {
      source => "message"
    }

    mutate {
      remove_field => "message"
    }
  }
}